[SSSD] [PATCH] fix offline detection/enumeration behavior in ldap_id

Simo Sorce ssorce at redhat.com
Thu Oct 22 13:35:09 UTC 2009


On Thu, 2009-10-22 at 08:20 -0400, Stephen Gallagher wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> On 10/21/2009 01:33 AM, Simo Sorce wrote:
> > I was seeing the ipa backend blocking on start trying to contact the KDC
> > and when failing not going offline, causing some applications (su -) to
> > take a looong time to complete as they make many nss calls, and where
> > waiting the KDC timeout for each call.
> > 
> > Simo.
> > 
> > 
> > 
> > _______________________________________________
> > sssd-devel mailing list
> > sssd-devel at lists.fedorahosted.org
> > https://fedorahosted.org/mailman/listinfo/sssd-devel
> 
> Rather than delaying for two seconds before starting the first
> enumeration, can we instead add a flag to the be_ctx that denotes when
> the ID provider is fully initialized, and just test every 500ms for
> whether it has been set and then do the first enumeration once it is?

The problem is that providers are now sbus servers and we don't really
know how many front-ends are going to connect to us.

> Two seconds might not be sufficient in slow (e.g. overseas) connections.

Not sure what you are meaning here. We are waiting to make any
connection to external servers for 2 seconds, to care first about
internal sbus connections. I think we could check that we are
successfully connected to the monitor and at least one frontend client
before firing I guess, but 2 seconds, while dirty is also much easier,
and does the job of not blocking initial connections (it still does
nothing to avoid bind operations to block for long times, and yes it
goes beyond the 5 seconds timeout because when openldap libraries call
SASL/GSSAPI apparently they can't enforce their timeout).
The real solution is to find a way to perform bind operation without
blocking. So I don't want to spend too much time to "fix" one of the
symptoms, because I want to spend that time to fix the "Real" problem
instead.

Simo.

-- 
Simo Sorce * Red Hat, Inc * New York




More information about the sssd-devel mailing list